Law firms get hacked for deal data
A successful cooperation between a law firm and its clients depends on the firm’s ability of keeping the details of these relationships confidential – something that becomes harder and harder as cyber spies hired by big companies and, occasionally, governments probe their networks.
US-based cybersecurity company Mandiant claims that in 2011, around 80 major U.S. law firms were hacked.
According to Bloomberg, some 200 New York City law firms were invited last November to a meeting set up by the cyber division in the New York City office of the FBI, where they were warned about the cyber criminals’ interest in breaching law firms’ systems in search of information that will give advantage to their clients.
“We told them they need a diagram of their network; they need to know how computer logs are kept,” said Mary Galligan, head of the aforementioned cyber division, and noted that while some were well prepared, others didn’t know what they were talking about.
A perfect example for showing that this trend must be taken seriously is the failed acquisition of a Canadian company that is the world’s largest potash producer.
In 2010, Australian BHP Billiton Ltd. was looking to buy Potash Corp. to the tune of around $40 billion. At the same time, China-based Sinochem Group was looking to do the same.
In order to do that, the Chinese chemical company (previously state owned) hired Deutsche Bank AG and Citigroup Inc. to assess possible measures to derail the nearly concluded deal between BHP and Potash Corp. And, according to Daniel Tobok, CEO of Canadian security consulting firm Digital Wyzdom, at the same time a number of law firms – including the one that was involved in brokering the deal – suffered intrusions into and disruptions of their networks and systems.
The hackers used a common tactic to gain access to them: they sent spoofed emails with attachments carrying spyware to the firm’s employees. Tobok says that an analysis of the malware revealed that it was compiled on a Chinese-language keyboard, and that China-based servers were used in the attack.
And the law firms were not the only ones targeted. The same approach was used to rifle to the systems of Canada’s Finance Ministry and the Treasury Board.
Other examples similar to this one can be easily cited – cyber espionage has, unfortunately, become an often used way of gaining an advantage when it comes to negotiating financial deals worth billions.
Although the aforementioned deal wasn’t concluded for other reasons, the investigation into the matter shows that law firms must begin considering having their own security experts protecting the information clients shared with them.
But, as Mary Galligan points out, their job might prove to be very difficult because in partners in law firms like to have the opportunity to review case documents – usually transferred by mail – on the road or at home, and they are used to getting their way. Convincing the to use more complex solutions to keep the documents safe from cyber spies is not going to be easy.